Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware
Summary
| CVE | CVE-2026-120295 |
|---|---|
| State | PUBLISHED |
| Assigner | EEF |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-10 11:16:41 UTC |
| Updated | 2026-11-10 11:16:41 UTC |
| Description | Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter. A moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization. This issue affects nerves_hub: from 1.0.0 before 2.5.3. |
Risk And Classification
Primary CVSS: v4.0 7.1 HIGH from 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-863 | CWE-863 CWE-863 Incorrect Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | Secondary | 7.1 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7.1 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Nerves-hub | Nerves Hub Web | affected 1.0.0 2.5.3 other | Not specified |
| CNA | Nerves-hub | Nerves Hub Web | affected 1.0.0 2.5.3 semver | Not specified |
| CNA | Nerves-hub | Nerves Hub Web | affected adaeefdb7a835525482588f43332ef988cc448c7 * git | Not specified |
| CNA | Nerves-hub | Nerves Hub Web | affected 79743ef08f7f801617b653fd09f37c01ed9b4be0 1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa git | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| osv.dev/vulnerability/EEF-CVE-2026-120295 | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | osv.dev | |
| github.com/nerves-hub/nerves_hub_web/commit/79743ef08f7f801617b653fd09f3... | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | github.com | |
| cna.erlef.org/cves/CVE-2026-120295.html | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | cna.erlef.org | |
| github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-... | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | github.com | |
| github.com/nerves-hub/nerves_hub_web/commit/adaeefdb7a835525482588f43332... | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | github.com | |
| github.com/nerves-hub/nerves_hub_web/commit/1bc8be875ab6b1eb904e5ff60c8a... | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: arbor-s (en)
CNA: arbor-s (en)
CNA: Josh Kalderimis (en)
CNA: Jonatan Männchen / EEF (en)
Additional Advisory Data
Solutions
CNA: Every move is recorded in the target product's audit log as "User moved device to : ". After upgrading, review the audit_logs rows with resource type NervesHub.Products.Product and a description containing "moved device" whose actor does not hold the manage or admin role in that organization, and move or remove the devices they brought in. Roles may have changed since a move, and entries older than the retention period are gone when TRUNCATE_AUDIT_LOGS_ENABLED is on.